From: Fabrice Bellard <fabrice@bellard.org>
Date: Mon, 3 Nov 2025 17:38:20 +0000 (+0100)
Subject: Fix length check in ArrayBuffer.prototype.slice (bnoordhuis) (#451)
X-Git-Url: http://git.kaiwu.me/postgresql/log/contrib/postgres_fdw/postgres_fdw.c?a=commitdiff_plain;h=c6fe5a98fd3ef3b7064e6e0145dfebfe12449fea;p=quickjs.git

Fix length check in ArrayBuffer.prototype.slice (bnoordhuis) (#451)
---

diff --git a/quickjs.c b/quickjs.c
index b4020d0..fcc7368 100644
--- a/quickjs.c
+++ b/quickjs.c
@@ -55626,7 +55626,7 @@ static JSValue js_array_buffer_slice(JSContext *ctx,
         goto fail;
     }
     /* must test again because of side effects */
-    if (abuf->detached) {
+    if (abuf->detached || abuf->byte_length < start + new_len) {
         JS_ThrowTypeErrorDetachedArrayBuffer(ctx);
         goto fail;
     }